JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 173.244.42.149

173.244.42.149 was found in our database!

This IP was reported 209 times. Confidence of Abuse is 0%: ?

ISP	ExpressVPN
Usage Type	Data Center/Web Hosting/Transit
ASN	AS137409
Domain Name	expressvpn.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 173.244.42.149

Whois 173.244.42.149

IP Abuse Reports for 173.244.42.149:

This IP address has been reported a total of 209 times from 94 distinct sources. 173.244.42.149 was first reported on April 18th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2026-05-12 22:47:28 (1 month ago)	ThreatBook Intelligence: Mobile,vpn_proxy more details on https://threatbook.io/ip/173.244.42.149 20 ... show more ThreatBook Intelligence: Mobile,vpn_proxy more details on https://threatbook.io/ip/173.244.42.149 2026-05-12 01:44:33 / 2026-05-12 01:25:48 / show less	Web App Attack
🇵🇱 bmino.pl	2026-01-15 17:21:44 (4 months ago)	Autoban IP(2): 173.244.42.149 - Hostname: unknown - City: Singapore - Region: Singapore - Country: S ... show more Autoban IP(2): 173.244.42.149 - Hostname: unknown - City: Singapore - Region: Singapore - Country: SG - Location: 1.2897,103.8501 - Organization: AS137409 GSL Networks Pty LTD - failed attempts. show less	Web App Attack
🇵🇱 sledzik1984	2026-01-15 17:03:54 (4 months ago)	2026-01-15T18:01:35.517023+01:00 cma wordpress(cma.pl)[1064772]: XML-RPC authentication attempt for ... show more 2026-01-15T18:01:35.517023+01:00 cma wordpress(cma.pl)[1064772]: XML-RPC authentication attempt for unknown user df7c8c98dfd88d9dfad from 173.244.42.149 2026-01-15T18:03:53.992486+01:00 cma wordpress(cma.pl)[1088416]: XML-RPC authentication attempt for unknown user admin-cma from 173.244.42.149 2026-01-15T18:03:54.023842+01:00 cma wordpress(cma.pl)[1088123]: XML-RPC authentication attempt for unknown user admin-cma from 173.244.42.149 ... show less	Web App Attack
Anonymous	2026-01-15 14:40:55 (4 months ago)	173.244.42.149 - - [15/Jan/2026:14:40:55 +0000] "GET /wp-login.php HTTP/1.1" 404 2742 "-" "Mozilla/5 ... show more 173.244.42.149 - - [15/Jan/2026:14:40:55 +0000] "GET /wp-login.php HTTP/1.1" 404 2742 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 kommunos	2026-01-15 13:34:43 (4 months ago)	/wp-login.php	Web App Attack
🇺🇸 rafled	2026-01-15 13:04:34 (4 months ago)	Attempt to login to Wordpress Admin	Web App Attack
🇳🇱 Site.eu	2026-01-15 03:58:08 (4 months ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇧🇪 voormedia	2026-01-14 21:00:50 (4 months ago)	Accessed trap at '/wp-login.php'	Web App Attack
Anonymous	2026-01-14 20:22:46 (4 months ago)	[redacted] 173.244.42.149 - - [14/Jan/2026:21:22:00 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "- ... show more [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:00 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] 173.244.42.149 - - [14/Jan/2026:21:22:42 +0100] "POST /wp/xmlrpc.php HTTP/2.0" 200 178 "-" "curl/7.30.0" [redacted] ... show less	Hacking Web App Attack
Anonymous	2026-01-14 20:21:43 (4 months ago)	wordpress-trap	Web App Attack
🇺🇸 TPI-Abuse	2026-01-14 19:28:44 (4 months ago)	(mod_security) mod_security (id:240335) triggered by 173.244.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 173.244.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 14:28:28.712925 2026] [security2:error] [pid 12873:tid 12873] [client 173.244.42.149:47840] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 173.244.42.149 (+1 hits since last alert)\|www.infinityartistsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.infinityartistsgroup.com"] [uri "/xmlrpc.php"] [unique_id "aWfuXHJUkwt7FZog9Z-QYQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-14 18:30:43 (4 months ago)	(mod_security) mod_security (id:240335) triggered by 173.244.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 173.244.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 13:30:33.589994 2026] [security2:error] [pid 27392:tid 27392] [client 173.244.42.149:34668] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 173.244.42.149 (+1 hits since last alert)\|www.alafiariverrendezvous.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.alafiariverrendezvous.org"] [uri "/xmlrpc.php"] [unique_id "aWfgyQFOK-MAgPERXQGQtQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-01-14 05:49:28 (5 months ago)	SMTP. NO LOGIN / auth failed	Port Scan Brute-Force
Anonymous	2026-01-05 18:36:37 (5 months ago)	173.244.42.149 - - [05/Jan/2026:18:36:37 +0000] "\x16\x03\x01\x05\xc6\x01" 400 392 "-" "-" ...	Bad Web Bot Web App Attack
Anonymous	2025-12-22 13:56:58 (5 months ago)	apache vulnerability scan	Web App Attack

Showing 1 to 15 of 209 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇿 212.154.179.73

🇩🇪 194.88.98.87

🇨🇳 183.221.20.144

🇨🇳 182.92.92.149

🇺🇸 172.110.223.185

🇺🇸 167.99.54.222

🇭🇰 154.194.251.12

🇺🇸 124.198.132.219

🇨🇳 122.51.248.133

🇺🇸 108.181.4.175

🇨🇦 67.220.94.161

🇺🇸 65.49.1.125

🇰🇷 43.164.190.40

🇨🇦 35.203.109.23

🇩🇪 31.220.0.26

🇧🇷 18.228.151.247

🇨🇳 14.103.114.90

🇧🇪 207.175.22.78

🇭🇰 199.45.154.120

🇻🇳 171.231.196.215